SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2012-6643

Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to (1) videos.php or (2) channels.php.

EXPLOIT ×2 ✓HIGH 7.5EPSS 1.54%

Does this matter?

2 public exploits are published in Exploit-DB (verified) and the impact is high, while EPSS rates exploitation at 1.5%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use.

Description

Multiple SQL injection vulnerabilities in the update_counter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to (1) videos.php or (2) channels.php. NOTE: some of these details are obtained from third party information.

CVSS 2.0
7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS
1.54% probability · 75th percentile
Public exploits
2 in Exploit-DB · verified · first 9 January 2012
CISA KEV
Not listed
Weakness
CWE-89
Affected
clip-bucket/clipbucket
Source
cve@mitre.org
EPSS trend
0%3%5%26 October 2026: 1.54%26 October 202626 October 2026

EPSS 1.5% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

Public exploits (2)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-IDTitleTypePublishedVerified
EDB-36532source ↗Clipbucket 2.6 - 'channels.php?time' SQL Injectionphp · YaDoY666webapps9 January 2012yes
EDB-36531source ↗Clipbucket 2.6 - 'videos.php?time' SQL Injectionphp · YaDoY666webapps9 January 2012yes

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.